Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24 results
Sep 28, 2026A vulnerability was detected in October CMS up to 4.3.4.CVE-2026-101005 · Other software · reported by VulDBMedium 5.5
A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 4.3.5 is able to mitigate this issue. You should upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2024A stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web scripts or HTML via aCVE-2024-25837 · Other software · Octobercms · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web scripts or HTML via a crafted payload into the Comments section.
- Product
- October
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgetastra.com
Feb 8, 2024Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3CVE-2023-25365 · Other software · Octobercms · reported by MITREHigh 7.8
Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3
- Product
- October
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcupc4k3.medium.comcupc4k3.medium.com
Jul 26, 2023An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file.CVE-2023-37692 · Other software · Octobercms · reported by MITREMedium 5.4
An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file.
- Product
- October
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordokankurtulus.com.trokankurtulus.com.tr
Jul 12, 2022October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework.CVE-2022-24800 · Other software · octobercms · reported by GitHubHigh 8.1
October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.476, 1.1.12, and 2.2.15, when the developer allows the user to specify their own filename in the `fromData` method, an unauthenticated user can perform remote code execution (RCE) by exploiting a race condition in the temporary storage directory. This vulnerability affects plugins that expose the `October\Rain\Database\Attach\File::fromData` as a public interface and does not affect vanilla installations of October CMS since this method is not exposed or used by the system internally or externally. The issue has been patched in Build 476 (v1.0.476), v1.1.12, and v2.2.15. Those who are unable to upgrade may apply with patch to their installation manually as a workaround.
- Product
- october
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2022October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework.CVE-2021-32650 · Other software · octobercms · reported by GitHubHigh 8.8
October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with access to the backend is able to execute PHP code by using the theme import feature. This will bypass the safe mode feature that prevents PHP execution in the CMS templates.The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their installation manually as a workaround.
- Product
- october
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2022October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework.CVE-2021-32649 · Other software · octobercms · reported by GitHubHigh 8.8
October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with "create, modify and delete website pages" privileges in the backend is able to execute PHP code by running specially crafted Twig code in the template markup. The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their installation manually as a workaround.
- Product
- october
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2021October CMS Improper AuthenticationCVE-2021-32648 · Other software · October CMS · reported by GitHubExploitedHigh 8.2
In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request.
- Product
- October CMS
- On CISA’s list since
- Jan 18, 2022 (federal fix deadline Feb 1, 2022)
- What to do
- Attackers are using this now. Install October CMS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Jul 14, 2020In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS CVE-2020-11083 · Other software · October CMS · reported by GitHubLow 3.5
In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. This has been fixed in 1.0.466. For users of the RainLab.Blog plugin, this has also been fixed in 1.4.1.
- Product
- October
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 2, 2020In October from version 1.0.319 and before version 1.0.467, pasting content copied from malicious websites into the Froala richeditor could result in a successfCVE-2020-4061 · Other software · October CMS · reported by GitHubLow 3.7
In October from version 1.0.319 and before version 1.0.467, pasting content copied from malicious websites into the Froala richeditor could result in a successful self-XSS attack. This has been fixed in 1.0.467.
- Product
- October
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2020The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests (and all information pertaining to each request includingCVE-2020-11094 · Other software · rainlab · reported by GitHubMedium 6.1
The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests (and all information pertaining to each request including session data) whenever it is enabled. This presents a problem if the plugin is ever enabled on a system that is open to untrusted users as the potential exists for them to use this feature to view all requests being made to the application and obtain sensitive information from those requests. There even exists the potential for account takeovers of authenticated users by non-authenticated public users, which would then lead to a number of other potential issues as an attacker could theoretically get full access to the system if the required conditions existed. Issue has been patched in v3.1.0 by locking down access to the debugbar to all users; it now requires an authenticated backend user with a specifically enabled permission before it is even usable, and the feature that allows access to stored request information is restricted behind a different permission that's more restrictive.
- Product
- debugbar-plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2018October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php#244 (makeFileContents function) thatCVE-2018-1999009 · Other software · Octobercms · reported by MITREHigh 8.1
October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php#244 (makeFileContents function) that can result in Sensitive information disclosure and remote code execution. This attack appear to be exploitable remotely if the /backend path is accessible. This vulnerability appears to have been fixed in Build 437.
- Product
- October
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoctobercms.comoctobercms.com
Jul 23, 2018October CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionality that can result iCVE-2018-1999008 · Other software · Octobercms · reported by MITREMedium 5.4
October CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionality that can result in an Authenticated user with media module permission creating arbitrary folder name with XSS content. This attack appear to be exploitable via an Authenticated user with media module permission who can create arbitrary folder name (XSS). This vulnerability appears to have been fixed in build 437.
- Product
- October
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoctobercms.comoctobercms.com
Apr 25, 2018An issue was discovered in the Users (aka Front-end user management) plugin 1.4.5 for October CMS.CVE-2018-10366 · Other software · User Project · reported by MITREMedium 6.1
An issue was discovered in the Users (aka Front-end user management) plugin 1.4.5 for October CMS. XSS exists in the name field.
- Product
- User
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Feb 17, 2018October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page.CVE-2018-7198 · Other software · Octobercms · reported by MITREMedium 6.1
October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page.
- Product
- October
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritywarrior9.blogspot.comexploit-db.com
Nov 25, 2017October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a CVE-2017-16941 · Other software · Octobercms · reported by MITREHigh 8.8
October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a .htaccess file. NOTE: the vendor says "I don't think [an attacker able to login to the system under an account that has access to manage/upload themes] is a threat model that we need to be considering.
- Product
- October
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2017October CMS build 412 is vulnerable to file path modification in asset move functionality resulting in creating creating malicious files on the server.CVE-2017-1000197 · Other software · Octobercms · reported by MITRECritical 9.8
October CMS build 412 is vulnerable to file path modification in asset move functionality resulting in creating creating malicious files on the server.
- Product
- October
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2017October CMS build 412 is vulnerable to PHP code execution in the asset manager functionality resulting in site compromise and possibly other applications on theCVE-2017-1000196 · Other software · Octobercms · reported by MITRECritical 9.8
October CMS build 412 is vulnerable to PHP code execution in the asset manager functionality resulting in site compromise and possibly other applications on the server.
- Product
- October
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2017October CMS build 412 is vulnerable to PHP object injection in asset move functionality resulting in ability to delete files limited by file permissions on the CVE-2017-1000195 · Other software · Octobercms · reported by MITREHigh 7.5
October CMS build 412 is vulnerable to PHP object injection in asset move functionality resulting in ability to delete files limited by file permissions on the server.
- Product
- October
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2017October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applicatiCVE-2017-1000194 · Other software · Octobercms · reported by MITRECritical 9.8
October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server.
- Product
- October
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2017October CMS build 412 is vulnerable to stored WCI (a.k.a XSS) in brand logo image name resulting in JavaScript code execution in the victim's browser.CVE-2017-1000193 · Other software · Octobercms · reported by MITREMedium 6.1
October CMS build 412 is vulnerable to stored WCI (a.k.a XSS) in brand logo image name resulting in JavaScript code execution in the victim's browser.
- Product
- October
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2017October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the sCVE-2017-1000119 · Other software · Octobercms · reported by MITREHigh 7.2
October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server.
- Product
- October
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoctobercms.compacketstormsecurity.com
Sep 27, 2017Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involviCVE-2015-5613 · Other software · Octobercms · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving a file title, a different vulnerability than CVE-2015-5612.
- Product
- October
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Sep 4, 2015Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via the caption tagCVE-2015-5612 · Other software · Octobercms · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via the caption tag of a profile image.
- Product
- October
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.